Assuming that trojans can be defined in a very large space of spatial and color image configurations, one can search for pairs of visually insignificant (or imperceptible) image changes and non-overlapping class encodings in order to improve robustness and convergence of trojan injections. Finding non-overlapping class encodings is related to the choice of AI model architecture (i.e., the choice of computation units and their connectivity) and can be framed as a type of a network architecture search (NAS) problem. If image classification training data and AI model architectures are understood in terms of utilization-based class encodings, then trojans can be designed in the image space to be encoded in underutilized computation units during training.
On the other hand, trojan detectors can become more efficient in predicting poisoned AI models by first identifying computation units of interest, such as with pruning approaches [1]}, [2]}, [3]}, [4]}. Trojan detectors can then be specialized by investigating subgraphs that (a) encode classes of trojans and (b) make the trojan search space for any detector much smaller.
